When we first create an account the user password is send via the template e-mail and anyone near the smartphone or PC monitor can see the password even someone who intercept the display card via remote.

This is probably in phpBB3\styles\yourstyle\template\ucp_profile_reg_details.html and {NEW_PASSWORD} that can be replaced with Your Password.